{"id":13813006,"url":"https://github.com/didi/kemon","last_synced_at":"2025-06-15T17:11:03.457Z","repository":{"id":83419729,"uuid":"143947987","full_name":"didi/kemon","owner":"didi","description":"An Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.","archived":false,"fork":false,"pushed_at":"2025-05-31T08:14:55.000Z","size":11706,"stargazers_count":386,"open_issues_count":3,"forks_count":73,"subscribers_count":38,"default_branch":"master","last_synced_at":"2025-05-31T19:51:35.706Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/didi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-08-08T02:02:03.000Z","updated_at":"2025-05-31T08:14:58.000Z","dependencies_parsed_at":"2025-05-14T22:41:42.398Z","dependency_job_id":null,"html_url":"https://github.com/didi/kemon","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/didi/kemon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didi%2Fkemon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didi%2Fkemon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didi%2Fkemon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didi%2Fkemon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/didi","download_url":"https://codeload.github.com/didi/kemon/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didi%2Fkemon/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260016055,"owners_count":22946321,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T04:00:59.898Z","updated_at":"2025-06-15T17:11:03.450Z","avatar_url":"https://github.com/didi.png","language":"C","readme":"# Kemon\nAn Open Source Pre and Post Callback-based Framework for macOS Kernel Monitoring.\n\n[ Breaking News - 08/28/2019 ]  \nmacOS Catalina 10.15 Beta 7 Release Notes  \nhttps://developer.apple.com/documentation/macos_release_notes/macos_catalina_10_15_beta_7_release_notes\n\nEndpoint Security\n - The kauth API has been removed. (50419013)\n\n/* After testing, I found that these Kauth interfaces are not really removed, and Kemon still works. But I think this release note means that the door to the macOS kernel is closing. (08/28/2019) */\n\n## What is Kemon?\nKemon is an open source Pre and Post callback-based framework [1] for macOS kernel monitoring [2]. With the power of Kemon, we can easily implement XPC/IPC communication monitoring [3], Mandatory Access Control (MAC) policy filtering, network traffic and kernel extension firewall, etc. In general, from an attacker's perspective, this framework can help achieve more powerful Rootkit. From the perspective of defense, Kemon can help construct more granular monitoring capabilities.\n\nI also implemented several kernel fuzzers [4] [7] based on this framework, which helped me find many kernel vulnerabilities, such as:\n\n1. Apple Silicon AGX-based GPU, IOMobileFrameBuffer and Display Co-processor (DCP) [10]:  \nCVE-2024-40854, CVE-2024-44197 [33], CVE-2024-44199 [34], CVE-2025-24111 [37], CVE-2025-24257 [35], CVE-2025-24273 [36], etc.\n\n3. Apple's AMD and Intel-based GPU:  \nCVE-2017-7155, CVE-2017-7163, CVE-2017-13883 [11], CVE-2018-4350, CVE-2018-4396, CVE-2018-4418 [12], CVE-2019-8807 [13], CVE-2022-22631, CVE-2022-22661, CVE-2022-46706 [23], etc.\n\n4. Wi-Fi IO80211FamilyV1/V2 [5] [9]:  \nCVE-2020-9832, CVE-2020-9833, CVE-2020-9834 [15], CVE-2020-9899 [16], CVE-2020-10013 [17] [18] [19], CVE-2022-26761 [24], CVE-2022-26762 [25], CVE-2022-32837, CVE-2022-32847, CVE-2022-32860 [26] [27] [28], CVE-2022-32925, CVE-2022-46709 [29] [30], CVE-2023-38610 [31] [32], etc.\n\n5. Bluetooth Host Controller Interface (HCI) [6]:  \nCVE-2020-3892, CVE-2020-3893, CVE-2020-3905, CVE-2020-3907, CVE-2020-3908, CVE-2020-3912, CVE-2020-9779, CVE-2020-9853 [14], CVE-2020-9831 [15], CVE-2020-9928, CVE-2020-9929 [16], etc.\n\n6. Kernel memory mapping mechanism [8]:  \nCVE-2020-27914, CVE-2020-27915, CVE-2020-27936 [20] [21], CVE-2021-30678 [22], etc.\n\n## Supported Features\nKemon's features include：\n- file operation monitoring\n- process creation monitoring\n- dynamic library and kernel extension monitoring\n- network traffic monitoring\n- Mandatory Access Control (MAC) policy monitoring, etc.\n\nIn addition, Kemon project can also extend the Pre and Post callback-based monitoring interfaces for any macOS kernel function.\n\n## Getting Started\n### How to build the Kemon kernel extension\nPlease use Xcode project or makefile to build the Kemon kext driver\n\n### How to use the Kemon kernel extension\nPlease turn off macOS System Integrity Protection (SIP) check if you don't have a valid kernel certificate  \nUse the command \"sudo chown -R root:wheel kemon.kext\" to change the owner of the Kemon kernel extension  \nUse the command \"sudo kextload kemon.kext\" to install the Kemon kernel extension  \nUse the command \"sudo kextunload kemon.kext\" to uninstall the Kemon kernel extension\n\n\n## Contributing\nWelcome to contribute by creating issues or sending pull requests. See Contributing Guide for guidelines.\n\n## License\nKemon is licensed under the Apache License 2.0. See the LICENSE file.\n\n## References\n1. https://patents.google.com/patent/US11106491B2\n2. https://www.blackhat.com/us-18/arsenal/schedule/#kemon-an-open-source-pre-and-post-callback-based-framework-for-macos-kernel-monitoring-12085\n3. https://www.blackhat.com/us-19/arsenal/schedule/#ksbox-a-fine-grained-macos-malware-sandbox-15059\n4. https://www.defcon.org/html/defcon-26/dc-26-speakers.html#Wang\n5. https://www.blackhat.com/us-20/briefings/schedule/index.html#dive-into-apple-iofamilyv-20023\n6. https://www.blackhat.com/eu-20/briefings/schedule/index.html#please-make-a-dentist-appointment-asap-attacking-iobluetoothfamily-hci-and-vendor-specific-commands-21155\n7. https://www.blackhat.com/us-20/arsenal/schedule/index.html#macos-bluetooth-analysis-suite-mbas-19886\n8. https://www.blackhat.com/asia-21/briefings/schedule/index.html#racing-the-dark-a-new-tocttou-story-from-apples-core-22214\n9. https://www.blackhat.com/us-22/briefings/schedule/#dive-into-apple-iofamily-vol--27728\n10. https://www.blackhat.com/us-25/briefings/schedule/index.html#dead-pixel-detected---a-security-assessment-of-apples-graphics-subsystem-45392\n11. https://support.apple.com/en-us/HT208331\n12. https://support.apple.com/en-us/HT209193\n13. https://support.apple.com/en-us/HT210722\n14. https://support.apple.com/en-us/HT211100\n15. https://support.apple.com/en-us/HT211170\n16. https://support.apple.com/en-us/HT211289\n17. https://support.apple.com/en-us/HT211843\n18. https://support.apple.com/en-us/HT211849\n19. https://support.apple.com/en-us/HT211850\n20. https://support.apple.com/en-us/HT211931\n21. https://support.apple.com/en-us/HT212011\n22. https://support.apple.com/en-us/HT212529\n23. https://support.apple.com/en-us/HT213183\n24. https://support.apple.com/en-us/HT213257\n25. https://support.apple.com/en-us/HT213258\n26. https://support.apple.com/en-us/HT213346\n27. https://support.apple.com/en-us/HT213345\n28. https://support.apple.com/en-us/HT213344\n29. https://support.apple.com/en-us/HT213446\n30. https://support.apple.com/en-us/HT213486\n31. https://support.apple.com/en-us/HT213938\n32. https://support.apple.com/en-us/HT213940\n33. https://support.apple.com/en-us/121564\n34. https://support.apple.com/en-us/120911\n35. https://support.apple.com/en-us/122371\n36. https://support.apple.com/en-us/122373\n37. https://support.apple.com/en-us/122066\n","funding_links":[],"categories":["C","Mac/iOS"],"sub_categories":["Containers"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidi%2Fkemon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdidi%2Fkemon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidi%2Fkemon/lists"}